Enable Service Log on for run as accounts

Security best practice is to disable interactive and remote interactive sessions for service accounts. Security teams across organizations have strict controls to enforce this best practice to prevent theft of credentials and associated attacks.

System Center Operations Manager supports hardening of service accounts and doesn't require granting the Allow log on locally user right for several accounts required in support of Operations Manager.

Earlier version of Operations Managers has Allow log on locally as the default log on type. Operations Manager uses Service Log on by default. This leads to the following changes:

• Health service uses log on type Service by default. For Operations Manager 1807 and earlier versions, it was Interactive.
• Operations Manager action accounts and service accounts now have Log on as a Service permission.
• Action accounts and Run As accounts must have Log on as a Service permission to execute MonitoringHost.exe. Learn more.

Changes to Operations Manager action accounts

The following accounts are granted Log on as a Service permission during the Operations Manager installation and during upgrade from the previous versions:

• Management Server Action account

• System Center configuration service and System Center data access service accounts

• Agent action account

• Data Warehouse Write account

• Data Reader account

  

After this change, any Run As accounts created by Operations Manager administrators for the management packs (MPs) require the Log on as a Service right, which administrators should grant.

View log on type for management servers and agents

You can view the log on type for management servers and agents from the Operations Manager console.

To view the log on type for management servers, go to Administration > Operations Manager Products> Management servers.

To view the log on type for agents, go to Administration > Operations Manager Products> Agents.

Note

Agent/gateway that is not yet upgraded, display Log on type as Service in console. Once the agent/gateway is upgraded, the current log on type will be displayed.

Enable service log on permission for Run As accounts

Follow these steps:

1. Sign in with administrator privileges to the computer from which you want to provide Log on as Service permission to a Run As accounts.

2. Go to Administrative Tools and select Local Security Policy.

3. Expand Local Policy and select User Rights Assignment.

4. In the right pane, right-click Log on as a service and select Properties.

5. Select Add User or Group option to add the new user.

6. In the Select Users or Groups dialog, find the user you wish to add and select OK.

7. Select OK in the Log on as a service Properties to save the changes.

   

Note

If you're upgrading to Operations Manager 2022 from a previous version or installing a new Operations Manager 2022 environment, follow the steps above to provide Log on as a service permission to Run As accounts.

Change log on type for a health service

If you need to change the log on type of Operations Manager health service to Allow log on locally, configure the security policy setting on the local device using the Local Security Policy console.

Here's an example:

Troubleshooting

If any of the Run as accounts do have the required Log on as a Service permission, a critical monitor-based alert appears. This alert displays the details of the Run As account, which doesn't have Log on as a Service permission.

On the agent computer, open Event Viewer. In the Operations Manager log, search for the event ID 7002 to view the details about the Run As accounts that require Log on as a Service permission.

Parameter	Message
Alert Name	Run As account doesn't have requested log on type.
Alert Description	The Run As account must have the requested log on type.
Alert Context	Health Service couldn't log on, as the Run As account for management group (group name) hasn't been granted the Log on as a service permission.
Monitor	(add monitor name)

Provide Log on as a Service permission to the applicable Run As accounts, which are identified in the event 7002. Once you provide the permission, event ID 7028 appears and the monitor changes to healthy state.